TCP Protocol

The device listens on TCP port 19, and implements an SCPI based protocol compatible with that of the Rigol DS1000 series. Responses received from the device are prefixed with a 32-bit, little-endian length field. The transport is implemented in hardware/common/scpi_tcp.c,
and the protocol by the rigol-ds driver.

USB Protocol

Work in progress.

The Rigol communication protocol only uses the USB control and bulk transfer. Control is for sending setup and request smaller amounts of data. Bulk transfers is returned by the Rigol box with setup and image data.

All control transfers interesting for us has request type set to 0xc0.
The request field in the control packets is what tells us which command
is actually sent.

All descriptions below should have both request type and request set to proper
values, obvious from the headlines what it should be.

Packet types

This information is completely reverse engineered by hand.

Read answer (request = 0x00)

Commands ending with a question mark ('?' ASCII 0x3f) returns answer in two control transfers.

First control transfer is to query the size of the data to be returned.
That is done by value set to 0. One byte of data is returned in the data field
by this operation which is the size of the string the Rigol box wants to return.

Second control transfer has value set to 1. The buffer, allocated to the size
just read, is also sent along the command to be filled with the data. The
returned data is an ASCII string.

Write command (request = 0x01)

Commands from the PC program to the Rigol box is sent as text strings.
Which commands that are available are listed in the Programming Guide from Rigol.

Each character is sent in a control message with the value set to the ASCII character to be sent. Each ASCII string is terminated with a carriage return (0x0d, '\r'), which terminates the transmission.

Request waveform data (Request = 0x04)

When waveform data is requested to be retrieved a control message is sent.
The index field of the setup data is a bitmask on which channels to be requested. It is encoded as bit 0 meaning Channel 1, bit 1 meaning Channel 2, bit 2 meaning Logic Channel 0, bit 3 meaning Logic Channel 1 etc.

The 4 byte data field of the control packet sent back as an ack contains number of bytes to be returned by bulk messages. It is encoded LSB first.

After that a series of bulk transfers occurs, with up to 4096 bytes in each transfer, until number of bytes given before is transferred. The first transfer can be (and usually, but not always, is) empty. The first returned data packet has a 780 byte header.

Data header

Last 8 bytes of header are identical to the ones returned by SETUP DSO? (Request = 0x06). Mostly contains zeroes so maybe can be omitted, however it does seem to contain some meaningful bytes, the meaning of which is as of yet unclear.

Address

Description

0x200

0x01 when trigger is "Single", 0x03 when Normal.

0x201-?

0x03 when trigger "Normal", number of bytes correlates to number of bulk transfers to return

Unknown control transfer (Request = 0x05)

This control transfer is unknown, but it occurs when stop has been pressed and streaming of big bulk blocks is terminated. All encoding in the control transfers are as described by request 0x04 above. The index field is always zero.

Returns 0x1000 or 0x080000 (the currently selected memory depth). After this request is called, bulk transfers occur the same way they would after request 0x04, except the data header is not present.

SETUP DSO? (Request = 0x06)

After this control transfer a bulk transfer occurs with 780 bytes of data.
What each byte means is still to be determined, but will occur in a separate description.
Same data is returned in response to undocumented instruction :SETUP:DSO? over TCP/IP.

When called in stop sequence returns an empty bulk transfer at first, after which the bulk transfer is reissued and returns the 780 bytes of data.

SETUP LA? (Request = 0x0c)

After this control transfer a bulk transfers occurs with 260 bytes of data.
What each byte means is still to be determined, but will occur in a separate description.
Same data is returned in response to undocumented instruction :SETUP:LA? over TCP/IP.

SETUP ALT? (Request = 0x0d)

After this control transfer a bulk transfers occurs with 396 bytes of data.
What each byte means is still to be determined, but will occur in a separate description.
Same data is returned in response to undocumented instruction :SETUP:ALT? over TCP/IP.

Transfer sequences

Turn-on sequence

*IDN?

:INFO:FPGA?

:STOP

SETUP DSO?

SETUP LA?

SETUP ALT?

Turn-off sequence

Nothing special.

Start reading waveform data

2 analogue channels.

:CLEARUSB

:RUN

SETUP DSO?

SETUP LA?

SETUP ALT?

SETUP DSO?

SETUP DSO? (waiting for something?)

Request waveform data.

The data is started get transferred using bulk transfer.

Stop reading waveform data

2 analogue channels.

:STOP

:CLEARUSB

Request waveform data, which returns with size 0.

Unknown transfer, which returns with waveform data without data header.